PT-2026-34878 · Unknown · Codechecker

Scott Tolley · Published 2026-04-24 · Updated 2026-05-05 · CVE-2026-25660

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CodeChecker versions prior to 6.27.4

Description An authentication bypass exists in CodeChecker, an analyzer tooling, defect database, and viewer extension for the Clang Static Analyzer and Clang Tidy. The issue occurs when the URL ends with Authentication in conjunction with certain function calls, allowing an attacker to assign arbitrary permissions to any existing user.

Recommendations Update to a version newer than 6.27.3.

Fix

Incorrect Authorization

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-863

CWE-290

Related Identifiers

CVE-2026-25660

GHSA-4V9X-CQC5-J645

Affected Products

Codechecker

References · 5

• https://github.com/Ericsson/codechecker/security/advisories/GHSA-4v9x-cqc5-j645 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25660 · Security Note
• https://osv.dev/vulnerability/GHSA-4v9x-cqc5-j645 · Vendor Advisory
• https://github.com/Ericsson/codechecker · Note
• https://twitter.com/CVEnew/status/2048099288635318294 · Twitter Post